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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  LOGISTICS  AGENCY 

COMMANDER,  DEFENSE  CONTRACT  MANAGEMENT 
COMMAND 

SUBJECT:  Audit  Report  on  the  Internal  Management  Control  Program  at  the  Defense 
Contract  Management  Command  (Report  No.  93-174) 


We  are  providing  this  final  report  for  your  information  and  use.  This  audit 
determined  whether  the  Defense  Contract  Management  Command  successfully 
implemented  the  Internal  Management  Control  Program. 

We  provided  a  draft  of  this  report  to  the  addressees  on  July  16,  1993.  Because 
the  report  contained  no  recommendations,  no  comments  were  required  of  management, 
and  none  were  received.  Additional  comments  are  not  required. 

We  appreciate  the  cooperation  and  courtesies  extended  to  the  audit  staff.  If  you  have 
any  questions  on  this  audit,  please  contact  Mr.  Salvatore  Guli,  Program  Director, 
at  (703)  692-3025  (DSN  222-3025)  or  Mr.  Bruce  Burton,  Project  Manager,  at 
(703)  692-3178  (DSN  222-3178).  Copies  of  this  report  will  be  distributed  to  the 
activities  listed  in  Appendix  D.  Audit  team  members  are  listed  inside  the  back  cover. 


Edwara  R.  Jones 

Deputy  Assist^t  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General,  DoD 
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(Project  No.  2CF-0034) 


September  30,  1993 


THE  INTERNAL  MANAGEMENT  CONTROL  PROGRAM  AT  THE 
DEFENSE  CONTRACT  MANAGEMENT  COMMAND 


EXECUTIVE  SUMMARY 


Introduction.  On  February  6,  1990,  the  Defense  Logistics  Agency  established  the 
Defense  Contract  Management  Command.  The  Defense  Contract  Management 
Command  provides  worldwide  contract  administrative  services  to  DoD  Components 
and  other  designated  Federal  and  State  agencies,  foreign  governments,  and  international 
organizations.  Each  DoD  agency  is  required  by  the  Federal  Managers'  Financial 
Integrity  Act  of  1982  to  perform  ongoing  evaluations  and  to  report  to  the  President  and 
Congress  on  the  adequacy  of  internal  accounting  and  administrative  control  systems. 

Objective.  The  audit  objective  was  to  determine  whether  the  Defense  Contract 
Management  Command  successfully  implemented  the  Internal  Management  Control 
program. 

Audit  Results.  The  23  Defense  Contract  Management  Command  district  and  field 
offices  did  not  adequately  implement  the  Internal  Management  Control  program.  Also, 
the  Defense  Contract  Management  Command  does  not  have  a  system  to  track  costs  for 
internal  control  functions  such  as  risk  assessments  and  control  reviews, 

o  Thirty-six  percent  of  the  risk  assessments  were  not  properly  completed,  and 
89  percent  of  the  internal  management  control  reviews  were  either  not  performed,  not 
adequate,  or  not  documented.  As  a  result,  internal  control  weaknesses  may  occur  and 
not  be  identified,  and  assessments  may  not  properly  measure  the  level  of  risks 
(Finding  A). 

o  The  automated  and  manual  risk  assessment  questionnaires  for  measuring 
vulnerability  were  inadequate  and  ineffective.  As  a  result,  vulnerability  of  assessable 
units  may  not  be  properly  determined,  and  the  real  risk  of  loss  may  not  be  effectively 
measured.  In  addition,  performance  plans  did  not  always  designate  internal 
management  control  responsibilities  for  personnel  involved  with  risk  assessments  and 
interned  management  control  reviews.  As  a  result,  the  Defense  Logistics  Agency  did 
not  adequately  hold  personnel  accountable  for  internal  management  control 
responsibilities  (Finding  B). 

o  The  Defense  Contract  Management  Command  is  taking  the  corrective  actions 
discussed  in  Part  II  to  address  the  deficiencies  disclosed  during  the  audit. 
Consequently,  we  made  no  recommendations  in  this  report.  No  comments  were 
required  of  management,  and  none  were  received. 
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Internal  Controls.  The  audit  identified  no  material  internal  control  weaknesses  related 
to  the  Internal  Management  Control  Program  at  Defense  Contract  Management 
Command.  See  Part  I  for  a  discussion  of  internal  controls  assessed. 

Potential  Benefits  of  Audit.  No  potential  monetary  benefits  were  identified  during  the 
audit.  Improving  internal  controls  could  result  in  potential  monetary  benefits; 
however,  the  benefits  could  not  be  quantified. 
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This  report  was  prepared  by  the  Contract  Management  Directorate,  Office  of  the 
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Part  I  -  Introduction 


Introduction 


Background 


On  February  9,  1990,  the  Defense  Logistics  Agency  (DLA)  established  the 
Defense  Contract  Management  Command  (DCMC).  DCMC  provides 
worldwide  contract  administrative  services  to  DoD  Components  and  other 
designated  Federal  and  State  agencies,  foreign  governments,  and  international 
organizations.  The  Internal  Management  Control  (IMC)  program,  implemented 
by  DCMC,  ensures  that  resources  and  programs  are  well  managed. 

DCMC  Organization.  DCMC  is  made  up  of  six  Defense  Contract 
Management  Districts  (DCMDs):  Northeast,  Mid-Atlantic,  North  Central, 
South,  West,  and  International.  Each  district  is  made  up  of  field  offices 
consisting  of  Defense  Contract  Management  Area  Offiees  (DCMAOs)  and 
Defense  Plant  Representative  Offices  (DPROs). 

Federal  Requirement.  The  Federal  Managers'  Financial  Integrity  Act  of  1982 
(the  Act)  was  enacted  to  amend  the  Budget  and  Accounting  Procedures  Act  of 
1950,  which  required  the  head  of  each  department  and  agency  to  ptablish  and 
maintain  adequate  systems  of  internal  controls.  The  Act  requires  that  the 
General  Accounting  Office  develop  internal  accounting  and  administrative 
control  standards.  The  Act  also  requires  that  each  executive  agency  conduct  an 
annual  evaluation  of  its  internal  accounting  and  administrative  controls  system 
in  accordance  with  guidelines  established  by  the  Director  of  the  Office  of 
Management  and  Budget.  Further,  the  head  of  each  executive  agency  is 
required  to  submit  an  annual  statement  to  the  President  and  to  the  Congress  on 
the  status  of  the  agency's  internal  controls  system. 

Department  of  Defense  Requirement.  DoD  Directive  5010.38,  "Internal 
Management  Control  Program,"  April  14,  1987,  implemented  the  Federal 
Managers'  Financial  Integrity  Act  and  Office  of  Management  and  Budget 
Circular  A-123,  "Internal  Controls  Systems."  DoD  Directive  5010.38  requires 
each  DoD  Component  to  implement  a  comprehensive  IMC  system  that  provides 
reasonable  assurance  that  obligations  and  costs  are  within  applicable  law,  and 
emphasizes  timely  correction  of  specific  weaknesses  and  prevention  of 
waste,  fraud,  and  mismanagement.  DoD  Directive  5010.38  also  requires  that 
each  agency  to  develop  a  5-year  Management  Control  program  to  be  updated 
annually.  The  primary  purpose  of  the  Management  Control  program  is  to 
identify  the  number  of  DoD  Component  risk  assessments  and  planned  follow-on 
actions  for  each  of  15  functional  reporting  eategories  over  the  5-year  period. 
DLA  Regulation  (DLAR)  5010.4,  "Internal  Management  Control  Program," 
October  12,  1990,  implements  the  IMC  program  requirements  for  DLA  and 
DCMC.  DLAR  5010.4  incorporates  the  guidelines  and  procedures  of 
DoD  Directive  5010.38  and  requires  DLA  Headquarters  to  assign  managers  of 
each  assessable  unit  the  responsibility  and  accountability  for  IMC  and  for 
performing  risk  assessments  and  IMC  reviews. 
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Executive  Departments  and  Agency  Responsibilities.  In  August  1986,  the 
Office  of  Management  and  Budget  revised  Circular  A-123  that  prescribes 
policies  and  procedures  to  be  followed  by  executive  departments  and  agencies  in 
establishing,  maintaining,  evaluating,  improving,  and  reporting  on  IMC  in  their 
program  and  administrative  activities.  Circular  A-123  prescribes  that  the  head 
of  each  agency  is  responsible  for  ensuring  that  the  design,  installation, 
documentation,  evaluation,  and  improvement  of  IMC  and  the  reports  issued  on 
the  agency's  IMC  are  in  accordance  with  the  requirements  of  the  Federal 
Managers'  Financial  Integrity  Act  and  Circular  A-123.  Each  department  and 
agency  should  establish  and  maintain  a  cost-effective  IMC  system  that  provides 
reasonable  assurance  that  Government  resources  are  protected  against  fraud, 
waste,  mismanagement,  and  misappropriation. 


Objective 


The  audit  objective  was  to  determine  whether  DCMC  successfully  implement^ 
the  IMC  program.  We  assessed  the  adequacy  of  the  IMC  program  and  its 
reporting  processes  and  reviewed  the  structure,  framework,  and  procedures  used 
in  its  implementation  and  the  implementation  of  the  Federal  Managers' 
Financial  Integrity  Act  from  the  DCMC  inception  date  of  February  6,  1990. 


Scope 


We  performed  the  audit  by  using  a  district-by-district  approach  to  review  fte 
IMC  program  implementation  at  DCMC.  We  reviewed  the  adequacy  of  risk 
assessments  performed,  of  completed  IMC  reviews,  and  of  the  oversight  and 
guidance  provided  to  field  offices  by  the  districts  and  by  DLA  Headquarters. 
We  also  reviewed  the  types  of  management  tools  used  to  prepare  risk 
assessments  and  to  determine  vulnerability. 

Universe  and  Sample.  The  total  universe  was  109  field  offices,  consisting  of 
37  DCMAOs  and  72  DPROs.  We  selected  a  stratified  sample  of  field  offices 
from  each  district.  We  randomly  selected  three  DCMAOs  and  five  DPROs 
from  each  of  the  districts;  however,  we  excluded  DCMD  International  from  the 
scope  of  this  audit. 

We  initially  reviewed  implementation  at  two  districts.  After  consulting  with  the 
IG,  DoD,  statistician,  we  selected  DCMD  Mid- Atlantic  and  DCMD  West  and 
visited  the  district  offices  and  16  field  offices.  Since  the  initial  results  disclosed 
widespread  problems  with  implementing  the  IMC  program,  we  determined  that 
review  of  24  more  sites  at  the  3  remaining  districts  was  not  necessary  to  validate 
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the  audit  results.  However,  based  on  a  DLA  Headquarters  request,  we 
reviewed  the  IMC  program  at  five  additional  offices  in 
DCMD  Northeast.  In  tot^,  we  conducted  reviews  at  23  district  and  field 
offices.  Appendix  C  lists  the  activities  visited. 

We  reviewed  the  method  for  gathering  data  and  for  measuring  risk  for  the 
Automated  Risk  Assessment  Program  at  district  and  field  offices.  We  also 
examined  documentation  of  risk  assessments  and  IMC  reviews  from  October 
1990  through  September  1992.  We  determined  that  data  such  as  the  weighting 
of  the  questions  used  to  measure  risk  and  the  measurement  of  the  level  of  risk, 
input  to  the  automated  program,  needed  improvements.  We  did  not  rely  on  any 
other  computerized  data  to  conduct  the  audit. 

Audit  Period  and  Standards.  This  program  audit  was  performed  from 
July  1992  to  April  1993  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD.  Accordingly,  the  audit  included  such  tests  of  internal  controls 
as  were  considered  necessary. 


Internal  Controls 


We  evaluated  internal  controls  related  to  the  implementation  of  the  IMC 
program  at  DCMC  district  and  field  offices.  We  assessed  the  level  of 
supervision  that  the  district  and  field  offices  used  when  performing  the  risk 
assessment  reviews  for  the  assessable  units.  We  reviewed  the  methods  and 
procedures  adopted  by  management  to  ensure  that  its  goals  and  objectives  were 
met  and  that  resources  were  used  consistent  with  Federal  Managers'  Financial 
Integrity  Act,  Office  of  Management  and  Budget  Circular  A-123, 
DoD  Directive  5010.38,  DLAR  5010.4,  and  local  policies.  No  material 
internal  controls  weaknesses  were  noted. 


Prior  Audits  and  Other  Reviews 


Inspector  General,  DoD,  Report  No.  92-055,  "Forward  Pricing  Rate 
Agreements,"  February  27,  1992.  The  report  stated  that  the  DPROs  did  not 
complete  internal  control  reviews  and  did  not  report  risk  assessment 
requirements  consistently.  The  report  disclosed  that  DPROs  did  not  fully 
comply  with  DLAR  5010.4  and  recommended  that  the  DCMC  commander 
initiate  actions  to  verify  that  the  DPROs  were  implementing  DLAR  5010.4.  As 
a  result  of  the  recommendation,  DLA  stated  that  it  would  hire  an  IMC  trainer  to 
identify  those  DPROs  not  in  compliance  with  the  DLAR  and  train  the 
appropriate  DPRO  personnel.  DLA  also  revised  DLAR  5010.4  to  clarify  the 
areas  of  risk  assessments  and  the  IMCs. 
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Inspector  General,  DoD,  Report  No.  91-013,  "Internal  Review  Activity  at  the 
Defense  Logistics  Agency,"  November  23,  1990.  The  audit  evaluated  the 
internal  review  activity's  effectiveness  in  identifying  and  reporting  internal 
control  deficiencies  and  verifying  that  internal  control  weaknesses  addressed  in 
prior  audit  reports  and  the  DLA  Annual  Statements  of  Assurance  were  corrected 
as  reported.  The  report  stated  that  the  internal  review  activity  needed  to 
improve  its  evaluation  and  reporting  of  internal  control  deficiencies  and  that 
DLA  did  not  have  effective  mechanisms  to  verify  completion  and  effectiveness 
of  corrective  actions.  DLA  partially  concurred  with  the  recommendation  to 
include  corrective  action  taken  on  material  weaknesses  in  the  DLA  Annual 
Statements  of  Assurance. 

Inspector  General,  DoD,  Report  No.  89-016,  "Report  on  the  Fiscal  Year  1988 
Evaluation  of  the  Implementation  of  the  Federal  Managers'  Financial  Integrity 
Act  of  1982  at  the  Defense  Logistics  Agency,"  October  21,  1988.  The  report 
stated  that  DLA  had  complied  with  the  requirements  of  Federal  Managers' 
Financial  Integrity  Act  and  that  no  material  changes  existed  in  the  system.  No 
recommendations  were  made. 

Inspector  General,  DoD,  Report  No.  88-033,  "Report  on  the  Fiscal  Year  1987 
Evaluation  of  the  Implementation  of  the  Federal  Managers'  Financial  Integrity 
Act  of  1982  at  the  Defense  Logistics  Agency,"  October  15,  1987.  The  report 
stated  that  DLA  had  complied  with  the  requirements  of  Federal  Managers' 
Financial  Integrity  Act  and  that  no  material  changes  existed  in  the  system.  No 
recommendations  were  made. 

DLA  Report  No.  DI-07-91,  "Review  of  the  Internal  Management  Control 
Program,"  May  14,  1992.  The  report  covered  the  results  of  the  DCMD  West 
IMC  program  for  the  period  October  1987  through  June  1991.  The  report 
stated  that  DCMD  West  had  not  completed  98  percent  of  the  planned  IMC 
reviews.  Of  the  10  completed  reviews,  only  1  was  completely  documented  and 
performed  in  accordance  with  DLAR  5010.4.  The  report  recommended  that  a 
process  action  team  establish  a  list  of  clearly  defined  assessable  units  and 
standardize  those  event  cycles  for  the  reviewers  to  use  in  the  new  5-year  cycle. 
At  the  time  of  our  audit,  the  process  action  team  had  begun  to  define  and 
standardize  assessable  units  and  event  cycles. 

Other  Matters  of  Interest 


Office  of  Management  and  Budget  Circular  A- 123  states  that  agencies  shall 
establish  and  maintain  a  cost-effective  system  of  internal  controls.  DCMC  does 
not  have  a  system  to  track  costs  for  internal  control  functions  such  as  risk 
assessments  and  control  reviews.  Management  needs  internal  control  cost 
information  to  make  prudent  decisions  on  use  of  resources.  This  cost 
information  is  especially  important  in  directing  assets  to  the  highest  priority 
work  in  light  of  current  and  future  reductions  in  Defense  budget  amounts. 
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Part  II  -  Results  of  Audit 
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Finding  A.  Risk  Assessments  and 
Internal  Management 
Control  Reviews 

DCMC  district  and  field  offices  either  did  not  perform  or  did  not 
complete  risk  assessments  and  IMC  reviews.  This  condition  existed 
because  DCMC  did  not  properly  implement  the  IMC  program  or  offer 
proper  guidance  and  training  to  personnel  at  the  3  district  and  20  field 
offices  on  how  to  conduct  the  assessments  and  reviews.  As  a  result, 
internal  control  weaknesses  may  exist  and  may  not  be  identified. 
Further,  assessments  may  not  properly  measure  the  level  of  risk  and  thus 
may  understate  the  susceptibility  to  fraud,  waste,  or  mismanagement. 


Background 


One  goal  of  the  IMC  program  is  to  increase  management's  awareness  of  the 
internal  control  structure  of  an  organization.  The  IMC  program  helps  to 
determine  whether  material  internal  control  weaknesses  exist  or  whether  risk  of 
loss  is  at  an  unacceptable  level.  DLAR  5010.4  prescribes  that  the  manager  of 
each  assessable  unit  is  responsible  for  managing  the  IMC  program  and  for 
performing  risk  assessments  and  IMC  reviews.  The  regulation  defines  risk 
assessment  as  a  review  documented  by  management  that  rates  an  assessable 
unit’s  susceptibility  to  fraud,  waste,  or  mismanagement.  DLAR  5010.4 
requires  DCMAOs  and  DPROs  to  perform  risk  assessment  reviews  at  branch 
levels  once  in  a  5-year  period.  The  regulation  also  r^uires  reviews  to  be 
completed  for  event  cycles  in  all  branches  at  least  once  in  a  designated  5-year 
period,  no  matter  what  the  current  risk  level.  An  assessable  unit  that  has  been 
rated  high  risk  must  have  an  IMC  review  performed  within  the  first  2  years  of 
the  5-year  period.  The  IMC  review  assists  in  determining  whether  actual 
practices  and  procedures  are  operating  in  the  manner  intended.  In  addition,  the 
regulation  states  that  adequate  documentation  will  be  provided  with  the  review 
to  allow  an  independent  reviewer  to  reach  the  same  conclusions. 


Emphasis  on  IMC  Program 


DCMC  did  not  consider  the  IMC  program  an  integral  part  of  daily  work 
requirements  and  therefore  did  not  emphasize  the  details  of  the  IMC  program, 
which  caused  errors  in  the  preparation  of  risk  assessments  and  reviews. 
Specifically,  district  and  field  offices  did  not  complete  risk  assessments  and  did 
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not  scrutinize  completed  risk  assessments  for  computational  and  other  errors. 
Additionally,  completed  EMC  reviews  often  lacked  supporting  documentation. 
Also,  the  3  district  and  20  field  offices  inconsistently  identified  assessable  units. 


Risk  Assessments 


We  determined  that  14  of  23  offices  had  assessable  units  for  which  management 
either  did  not  perform  risk  assessments  or  did  not  perform  complete  risk 
assessments.  In  total,  managers  at  the  offices  did  not  properly  complete 
56  (36  percent)  of  the  154  manually  prepared  risk  assessments  we  examined. 
We  concluded  that  DCMC  did  not  provide  adequate  guidance  and  oversight  to 
the  district  and  field  offices  for  the  IMC  program. 

Performance  of  Risk  Assessments.  Of  the  14  offices,  5  offices  did  not 
perform  risk  assessments  for  some  assessable  units,  4  offices  did  not  prepare 
complete  risk  assessments,  and  5  offices  exhibited  both  traits  during  FYs  1990 
through  1992.  Appendix  A  summarizes  the  risk  assessments.  One  primary  area 
of  confusion  for  management  relates  to  risk  assessments  for  the  Command 
Support  functions,  a  function  that  includes  the  administrative  duties  in  support 
of  the  commander's  office  such  as  travel,  training,  and  other  administrative 
duties.  Although  most  offices  considered  the  Command  Support  function  to  be 
an  assessable  unit,  six  offices  did  not  prepare  risk  assessments  for  these  units. 
Therefore,  confusion  over  what  constituted  an  assessable  unit  was  magnified  by 
a  lack  of  communication  between  the  district  office  and  the  field  office.  The 
field  offices  relied  on  the  district  office  to  prepare  a  consolidated  risk 
assessment  of  the  Command  Support  function.  However,  the  district  IMC 
coordinator  for  DCMD  Mid-Atlantic  assumed  that  all  field  offices  were 
preparing  risk  assessments  for  the  Command  Support  function  and  was  not 
aware  that  the  assessments  were  not  being  done  until  our  visit. 

An  example  of  a  deficiency  in  risk  assessments  occurred  when  a  preparer 
copied  the  results  of  a  previous  risk  assessment  onto  a  current  risk  assessment, 
implying  it  was  current  for  that  year.  Another  deficiency  occurred  when  the 
same  person  who  prepared  the  risk  assessment  in  1989  also  reviewed  it  in  1991. 
We  determined  that  the  deficiencies  occurred  because  DCMC  did  not  provide 
adequate  oversight  and  did  not  give  guidance  or  training  to  personnel  who 
handled  risk  assessments. 

Consistency  of  Assessable  Units.  District  and  field  office  personnel  performed 
risk  assessments  at  various  organizational  levels  (assessable  unit)  that  were  not 
in  accordance  with  DLA  regulations.  An  assessable  unit  is  any  organizational, 
functional,  programmatic,  or  other  appropriate  division  capable  of  being 
evaluated  by  IMC  procedures.  The  normal  organizational  structure  at  district 
and  field  office  consists  of  the  Commander,  divisions,  and  branches.  Branch 
personnel  performed  IMC  reviews  based  on  event  cycles.  Event  cycles  are  a 
series  of  steps  or  processes  to  get  things  done. 
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Of  the  23  offices  visited,  15  performed  risk  assessments  at  either  the  division 
level  or  the  event  cycle  level,  even  though  DLAR  5010.4  specified  that  risk 
assessments  should  be  performed  at  the  branch  level.  In  addition,  these  same 
field  offices  inconsistently  prepared  risk  assessments.  For  example,  at  14  field 
offices,  personnel  prepared  risk  assessments  at  the  branch  level  while  other 
personnel  in  that  same  office  prepared  risk  assessments  at  the  division  level  or 
event-cycle  level.  These  deficiencies  are  examples  of  weaknesses  in  the  IMC 
program.  Appendix  A  summarizes  the  field  offices  and  the  levels  at  which  the 
risk  assessments  were  performed. 

Risk  Assessment  Questionnaires.  Risk  assessment  questionnaires  are  used  to 
evaluate  the  overall  vulnerability  of  an  assessable  unit.  The  questionnaires 
contained  mathematical  errors  that  affected  the  end  result  of  the  risk  analysis. 
For  example,  a  risk  assessment  completed  at  an  office  in  the  DCMD 
Mid-Atlantic  contained  a  mathematical  error.  The  error  caused  the  preparer  to 
determine  a  low  "existing  control"  risk  rating  when  in  fact  the  risk  was 
moderate.  This  example  illustrates  how  easily  the  preparer  can  incorrectly 
assess  the  level  of  risk. 

Risk  assessments  also  contained  confusing  questions  and  unclear  instructions  to 
the  user.  As  an  example,  a  preparer  was  confused  about  the  rating  system  on 
the  risk  assessment.  The  preparer  thought  that  a  high-risk  rating  meant  a  high 
level  of  assurance,  when  in  fact  it  means  the  opposite.  As  a  result,  the 
assessment  incorrectly  stated  the  level  of  risk  for  the  assessable  unit.  The 
wording  of  the  questions  on  the  risk  assessments  caused  the  preparers  to 
understate  or  overstate  the  level  of  risk. 


IMC  Reviews 


Not  all  district  and  field  offices  followed  DLAR  5010.4  when  performing 
IMC  reviews.  District  and  field  offices  either  did  not  perform  or  did  not 
adequately  perform  IMC  reviews  because  of  a  lack  of  guidance  and  training. 

Quality  of  IMC  Reviews.  Of  the  424  IMC  reviews  examined  at  the  3  districts, 
376  were  inadequate.  In  total,  75  percent  of  the  reviews  had  no  documentation, 
13  percent  had  only  partial  documentation,  1  percent  was  improperly  tested,  and 
11  percent  was  fully  supported.  See  Appendix  B  for  summary  details  for  each 
district  and  field  office.  Additionally,  IMC  reviews  contained  other  problems, 
the  majority  being  that  preparers  misinterpreted  or  incorrectly  interchanged  the 
control  objectives,  techniques,  and  event  cycles. 

An  event  cycle  on  which  an  IMC  review  would  be  performed  is  a  series  of  steps 
taken  to  get  something  done.  An  example  of  an  event  cycle  would  be  the 
review  of  progress  payments.  The  control  objective  in  the  event  cycle  should  be 
tied  to  a  risk,  with  its  goal  to  reduce  that  risk.  The  control  techniques  are  the 
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actual  steps  or  procedures  in  place  that  are  used  to  meet  the  control  objective. 
We  discovered  that  personnel  performing  IMC  reviews  developed  event  cycles 
that  could  not  be  specifically  measured  or  tested.  In  one  example,  the  event 
cycle  was  "to  maximize  competition,"  but  the  preparer  did  not  develop  specific 
steps  to  test  or  measure  this  event  cycle. 

In  four  functional  areas  within  DCMD  Northeast,  personnel  did  not  perform 
IMC  reviews  for  the  5-year  period  from  FYs  1988  through  1992  because  the 
district  assessable  units  had  low-risk  ratings.  The  personnel  responsible  for 
preparing  IMC  reviews  assumed  that  if  the  risk  was  low,  then  they  were  not 
required  to  do  the  IMC  reviews. 

Preparers  were  often  unaware  of  the  requirement  in  DLAR  5010.4  that  specifies 
that  the  documentation  accompanying  each  IMC  review  must  be  sufficient  to 
enable  an  independent  reviewer  to  arrive  at  the  same  conclusion  as  the  preparer. 

Other  Conditions.  We  noted  other  problems  in  establishing  evidence  of 
preparation  and  review  of  IMC  reviews.  Personnel  performing  IMC  reviews 
were  both  the  preparer  and  reviewer.  This  dual  role  violates  essential  rules  of 
internal  controls  on  separation  of  duties  and  establishing  checks  and  balances. 
Also,  preparers  of  IMC  reviews  prepared  a  number  of  reviews  all  in  1  day.  For 
example,  at  one  location,  the  same  person  prepared  18  reviews  in  1  day,  and 
another  person  reviewed  the  18  reviews  on  another  day.  This  level  of 
performance  equates  to  less  than  30  minutes  for  each  risk  assessment  during  a 
normal  8-hour  day.  Time  spent  is  not  commensurate  with  the  high  level  of 
significance  and  importance  that  this  duty  entails.  Additionally,  the  preparer  or 
the  reviewer  or  both  did  not  sign  about  16  percent  of  the  IMC  reviews. 

Alternative  Internal  Management  Control  Reviews.  The  field  offices  used 
Alternative  Internal  Management  Control  Reviews  (AIMCRs)  for  their  IMC 
reviews.  AIMCRs  are  performed  for  other  purposes  and  can  be  used  to  meet 
the  requirement  for  performing  an  IMC  review  such  as  reviews  done  for 
IG,  DoD,  audit  reports.  Alternative  reviews  should  determine  that  control 
techniques  in  an  assessable  unit  comply  with  Office  of  Management  and  Budget 
Circular  A- 123. 

In  some  cases,  AIMCRs  were  improperly  used  as  substitutes  for  IMC  reviews. 
Field  offices  were  using  reviews  that  evaluated  contractor  functions  at  DPROs 
or  otherwise  failed  to  review  internal  controls  at  field  offices.  An  example 
would  be  a  Defense  Contract  Audit  Agency  review  of  progress  payments  to  a 
contractor.  This  review  is  not  a  review  of  the  DCMC  function  and  oversight  of 
progress  payments  and  should  not  be  considered  an  AIMCR.  The  AIMCRs 
were  also  inconsistently  treated  in  the  field  office  5-year  Management  Control 
plans.  Sometimes  AIMCRs  were  included  as  completed  IMC  reviews  and  at 
other  times  they  were  not  mentioned  in  the  5-year  plan. 
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Contributing  Factors 


Deficiencies  in  the  IMC  program  stem  from  a  lack  of  appropriate  training, 
guidance,  and  oversight  by  DCMC  Headquarters  and  the  district  offices. 
Besides  training,  the  actual  success  of  the  IMC  program,  to  a  certain  extent, 
depends  on  the  level  of  guidance  and  oversight  that  higher-level  offices  provide. 
DCMC  Headquarters  written  and  oral  guidance  will  tdlow  field  offices  to  better 
prepare  risk  assessments  and  IMC  reviews.  Oversight  and  feedback  from 
DCMC  Headquarters  will  allow  the  district  offices  to  monitor  the  performance 
of  IMC  reviews  and  risk  assessments  prepared  at  the  field  offices. 

Training.  The  DCMDs  Mid-Atlantic  and  West  did  not  provide  adequate 
training  for  personnel  in  charge  of  preparing  the  IMC  reviews.  The  1-  to  2-day 
IMC  program  training  courses  DLA  provid^  to  the  field  offices  did  not  address 
the  requirement  to  adequately  document  each  review.  DLAR  5010.4  states  that 
all  reviews  should  produce  written  materials  documenting  what  was  done  and 
what  was  found.  The  deficiency  in  the  training  was  evident  by  the  lack  of 
documentation  supporting  the  IMC  reviews.  Of  the  424  IMC  reviews  examined 
during  the  audit,  only  50  (12  percent)  were  supported  with  sufficient 
documentation  to  allow  an  independent  reviewer  to  follow  the  review  and  reach 
a  similar  conclusion. 

DCMC  had  no  uniform  training  approach  for  the  IMC  program.  Training 
courses  varied  between  districts  and  were,  in  our  opinion,  based  on  old 
philosophies  of  the  former  Defense  Contract  Administration  Services  Regions 
rather  than  a  new  DCMC  approach.  For  example,  personnel  who  prepared  the 
IMC  reviews  at  the  DPRO  General  Dynamics,  Lima,  Ohio,  a  former  Army 
Plant  Representative  Office,  did  not  know  that  documentation  was  required  to' 
support  IMC  reviews.  Before  1990,  while  assigned  to  the  Army,  the  risk 
assessments  and  IMC  reviews  were  prepared  by  Army  Headquarters  personnel 
instead  of  the  Army  Plant  Representative  Office  personnel.  Training  for  DPRO 
General  Dynamics  personnel  was  provided  by  the  former  Defense  Contract 
Administration  Services  Region,  Cleveland,  Ohio,  and  encompassed  the 
Cleveland  region’s  approach  to  preparing  IMC  reviews. 

This  inconsistent  training  approach  to  the  IMC  program  is  also  evident  by  the 
various  forms  that  the  districts  used  in  preparing  IMC  reviews.  As  an  example, 
DCMD  West  used  the  former  Defense  Contract  Administration  Services 
Region,  Los  Angeles,  form  while  DCMD  Mid-Atlantic  used  the  former  Defense 
Contract  Administration  Services  Region,  New  York,  form  for  some  of  its  IMC 
reviews.  The  varying  experience  and  background  of  the  individual  offices  were 
not  taken  into  consideration  when  developing  and  implementing  field  office 
training. 

Although  training  courses  were  scheduled  for  the  district  and  field  offices,  not 
all  personnel  received  training.  Also,  DCMC  personnel  who  received  training 
expressed  dissatisfaction  with  the  training  because  they  believed  the  training 
pertained  more  to  financial  managers  and  did  not  give  appropriate  attention  to 
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the  administrative  and  functional  areas  involved  in  contract  administration.  In 
other  instances,  personnel  indicated  that  the  training  was  too  general  and  lacked 
sufficient  detail  on  preparing  risk  assessments  and  IMC  reviews. 

In  contrast,  DCMD  Northeast  initiated  its  own  training  program,  which 
adequately  covered  the  IMC  program.  The  course  offered  a  detailed  approach 
to  the  IMC  program  and  could  be  used  as  a  model  for  creating  a  new, 
comprehensive  IMC  training  program  for  all  DCMC  districts. 

Guidance.  The  districts  sent  written  guidance  to  the  field  offices  regarding 
aspects  of  the  IMC  program.  However,  at  the  time  of  our  visits,  field  offices 
were  unable  to  provide  evidence  that  they  had  either  received  or  maintained 
all  correspondence  from  the  districts  on  the  IMC  program.  As  an  example, 
six  of  eight  field  offices  were  not  able  to  provide  us  with  a  copy  of  a 
memorandum  that  originated  from  DCMD  Mid-Atlantic  that  explained  the 
requirements  for  documentation  of  IMC  reviews.  This  particular  memorandum 
was  supposedly  distributed  district-wide.  Insufficient  distribution  of  guidance  or 
lack  of  record  keeping  allowed  inadequate  reviews  to  be  performed  throughout 
all  the  districts. 

Oversight.  The  districts  can  provide  oversight  by  conducting  staff  assistant 
visits  and  by  providing  feedback  on  the  quality  of  risk  assessments  and 
IMC  reviews  that  are  forwarded  from  the  field  offices.  The  districts  performed 
staff  assistance  visits  at  field  offices  to  assess  the  operation  of  various  field 
office  functions  or  to  evaluate  overall  performance  for  that  field  office. 
However,  the  districts  usually  did  not  review  the  IMC  program  during  the 
visits.  Districts  reviewed  the  IMC  programs  of  only  2  of  20  field  offices  in  our 
review.  In  general,  no  evidence  indicates  that  the  districts  reviewed  field  office 
risk  assessments  and  IMC  reviews  for  content  and  format.  The  monitor  for 
DCMD  West  stated  he  did  not  have  the  time  to  review  risk  assessments  and 
IMC  reviews.  In  other  districts  where  feedback  was  provided,  the  written 
comments  were  confined  to  "good  job,"  when  in  fact  the  reviews  did  not  have 
any  supporting  documentation.  In  several  instances,  the  feedback  was  so 
incomplete  that  the  district  IMC  monitor  was  actually  unaware  that  certain 
assessable  units  were  inconsistently  treated  or  not  reviewed  by  field  offices. 


DCMC  Ongoing  Corrective  Actions 


In  response  to  our  review,  DLA  Policy  Division  has  issued  memorandums  to  its 
subordinate  offices  addressing  the  IMC  program.  To  make  employees  more 
aware  that  IMC  is  an  integral  part  of  their  work,  DLA  has  restructured  the 
program  by  redefining  IMC  reviews  and  risk  assessments  as  processes  that  are 
integrated  with  work  duties.  DLA  is  also  preparing  a  DCMC  manual,  the 
"One  Book."  The  manual  describes  the  best  methods  for  the  core  processes  of 
DCMC.  The  One  Book  chapter  on  the  IMC  program  will  provide  guidance  on 
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sampling  techniques  and  recommended  formats  for  worksheets  to  be  used  for 
process  reviews.  Also,  each  process  review  will  have  a  chapter  devoted  to  flow 
charts,  process  goals,  and  process  controls  required  for  a  process  review. 

Process  Risk  Assessments  and  Process  Reviews.  Districts,  instead  of  each 
individual  field  office,  will  now  perform  process  risk  assessments.  The  districts 
were  to  be  required  to  complete  the  first  series  of  process  risk  assessments  in 
FY  1993  and  forward  assessments  to  DCMC  Headquarters.  DCMC 
Headquarters  will  then  make  the  final  determination  of  the  overall  risk.  The 
Management  Control  program  will  be  set  by  each  district  for  the  5-year  plan  for 
FYs  1993  through  1997. 

Field  offices  will  conduct  process  reviews  using  the  flow  charts,  process  goals, 
and  process  controls  provided  in  the  One  Book.  This  will  standardize  process 
reviews  and  eliminate  the  use  of  the  AIMCRs  at  the  field  offices.  All  the 
process  reviews  will  be  required  to  be  completed  during  the  first  6  months  of 
the  fiscal  year  in  which  they  are  scheduled.  The  districts  will  assess  the  reviews 
during  the  third  quarter  and  forward  to  DCMC  Headquarters  the  summaries  of 
results  including  any  material  weaknesses. 

Documentation.  Each  activity  will  be  required  to  maintain  a  central  file  of 
complete  documentation  for  process  reviews  covering  a  5-year  period.  The 
districts  will  also  maintain  the  5-year  file  on  the  review  documentation  provided 
by  their  field  offices. 
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The  DCMC  automated  and  manual  risk  assessment  tools  for 
implementing  the  IMC  program  were  inadequate  and  ineffective.  In 


addition,  performance 
responsibilities.  Sixty-eig 
not  have  a  separate  critica' 


plans  did  not  separately  designate  IMC 
;ht  of  seventy-three  personnel  in  our  review  did 
element  for  internal  controls.  The  tools  were 
inadequate  because  DCMC  Headquarters  and  district  personnel  did  not 
emphasize  the  program,  nor  did  the  personnel  modify  the  risk 
assessments  to  adequately  assess  risks  for  the  mission  and  functions  of 
assessable  units.  DCMC  Headquarters  personnel  also  did  not  verify  that 
military  and  civilian  performance  plans  designate  IMC  responsibilities 
for  district  and  field  office  personnel  involved  with  risk  assessments  and 
IMC  reviews.  As  a  result,  DCMC  may  not  be  properly  evaluating  the 
vulnerability  of  assessable  units  and  may  not  be  effeetively  measuring 
the  real  risk  of  loss.  In  addition,  managers  are  not  adequately  held 
accountable  for  IMC  responsibilities  in  their  assigned  area  and  thus  IMC 
duties  may  not  be  performed. 


Risk  Assessment 


DCMC  conducts  risk  assessments  of  its  assessable  units  using  two  basic 
tools:  an  automated  risk  assessment  and  a  manual  risk  assessment.  District  and 
field  offices  inconsistently  applied  risk  assessment  tools.  Some  offices  were 
using  the  automated  risk  assessment  while  others  were  using  various  formats  of 
the  manual  risk  assessment.  The  DCMC  goal  is  to  eventually  have  all  DCMC 
district  and  field  offices  using  the  automated  program  to  assess  risk.  However, 
in  our  opinion,  deficiencies  in  both  the  automated  and  the  manual  risk 
assessments  cause  both  systems  to  be  ineffective  tools  for  assessing  risk. 

Automated  Risk  Assessment.  The  Automated  Risk  Assessment  Program, 
developed  in  1990  by  DLA,  is  a  computerized  system  that  calculates  risks  based 
on  answers  to  statements  and  questions  about  vulnerability.  The  Automated 
Risk  Assessment  Program  provides  a  measure  of  vulnerability  to  assist  in 
directing  resources  to  the  areas  with  the  greatest  potential  for  loss.  The 
Automated  Risk  Assessment  Program  calculates  an  overall  risk  based  on  the 
potential  risk  of  loss  and  the  existing  safeguards. 

Effectiveness  of  Automated  Risk  Assessments.  Automated  risk 
assessments  were  ineffective  and  did  not  adequately  assess  the  true  risk.  We 
noted  problems  with  the  way  weight  was  applied  to  certain  questions  developed 
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to  assess  risk,  apparent  contradiction  in  statements  in  automated  risk  assessment 
reports,  and  an  inappropriate  method  for  determining  the  level  of  risk  for 
existing  safeguards. 

Weighting  of  Questions.  Questions  were  not  weighted  so  that  the  most 
important  questions  to  the  assessment  were  given  greater  significance  in 
determining  the  overall  risk.  For  example,  questions  for  which  the  responses 
indicated  past  instances  of  fraud,  waste,  abuse,  or  mismanagement;  the  handling 
of  classified  or  sensitive  information;  and  the  process  having  impact  on  the 
economic  well-being  of  outside  contractors  and  Government  agencies  are  more 
significant  and  should  be  given  greater  emphasis.  In  contrast,  questions  as  to 
whether  the  process  is  subject  to  vague  legislative  authority  or  regulations  and 
whether  the  process  is  subject  to  interest  from  the  President  should  be  given  less 
emphasis  as  they  are  less  significant  in  assessing  the  overall  risk.  Because  all 
questions  are  given  equal  weight,  it  is  possible  for  the  risk  assessment  to 
disclose  weaknesses  in  several  significant  areas  and  still  result  in  an  overall  low 
vulnerability  rating. 

Testing  of  Scenarios.  We  tested  our  conclusion  at  DCMD  Northeast  by 
running  seven  scenarios  through  the  automated  program.  In  ^ch  of  the 
scenarios,  most  or  all  of  the  significant  questions  were  answered  indicating  high 
potential  loss  or  weak  controls,  while  the  less  important  questions  were 
answered  indicating  low  potential  loss  or  strong  controls.  Only  one  of  the 
scenarios  resulted  in  an  overall  high  vulnerability.  Because  of  the  equal 
weighting  of  questions,  the  responses  to  the  more  significant  questions  were 
offset  by  the  responses  to  the  less  significant  questions.  Thus,  two  of  the 
scenarios  resulted  in  low  vulnerability  and  four  resulted  in  rnoderate 
vulnerability.  Based  on  the  greater  significance  of  the  questions  to  which  high 
risk  or  weak  controls  were  indicated,  it  is  our  opinion  that  the  low  and  moderate 
risk  ratings  understated  the  true  vulnerability.  The  weighting  of  questions  will 
give  the  more  significant  questions  greater  emphasis  and  thus  result  in  a  more 
accurate  assessment  of  the  real  risk. 

In  addition  to  the  lack  of  weighting  of  questions,  some  questions  were 
structured  in  such  a  way  that  biased  responses  could  result.  Other  questions 
were  of  such  a  nature  that  the  preparer  of  the  assessment  may  not  have  had  a 
sense  of  independence  to  accurately  answer  the  question  and  could  feel 
pressured  to  slant  a  response  to  one  more  favorable  to  management. 
Two  examples  of  such  questions  are,  "Does  management  support  the  internal 
controls  in  place  on  this  process?"  and  "Do  you  have  a  good  working 
relationship  in  support  of  this  process  with  your  superiors  and  subordinates?" 

Complying  with  Internal  Controls.  The  reports  generated  under  the 
Automated  Risk  Assessment  Program  included  two  inconsistent  statements. 
First,  when  certain  responses  were  given,  the  reports  indicated  uncertainty  in 
whether  the  controls  complied  with  the  General  Accounting  Office  Standards  of 
Internal  Control.  Second,  the  same  reports  indicated  that,  based  on  the  work 
setting  and  compliance  with  the  General  Accounting  Office  Standards  of 
Internal  Control,  the  existing  safeguards  were  considered  strong.  DCMC  needs 
to  correct  this  contradiction.  Furthermore,  the  risk  assessments  should 
determine  without  any  uncertainty  whether  the  assessed  unit  complies  with  the 
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General  Accounting  Office  Standards  of  Internal  Control.  Questions  that  allow 
personnel  to  indicate  uncertainty  as  to  whether  certain  controls  exist  should  be 
changed  to  require  additional  review  or  analysis  so  that  a  "yes"  or  "no" 
determination  can  be  made. 

Applying  Existing  Safeguards.  Another  problem  with  the  Automated 
Risk  Assessment  Program  is  the  method  used  to  determine  the  level  of  risk  for 
the  existing  safeguards  portion  of  the  risk  assessment.  Risk  ratings  were 
determined  for  each  of  five  subsections  comprising  the  existing  safeguards. 
These  values  were  then  combined  to  determine  the  overall  risk  assessment  for 
existing  safeguards.  To  determine  the  risk  rating  for  each  subsection,  values 
were  assigned  to  each  "yes"  or  "no"  response.  These  values  were  totted  and 
then  divided  by  the  number  seven  to  arrive  at  the  risk  rating  for  that  subsection, 
with  a  rating  of  one  or  greater  being  strong  safeguards  and  less  than  one,  weak 
safeguards.  The  number  seven,  however,  was  arbitrarily  chosen  as  the  divisor 
and  does  not  appear  to  provide  an  accurate  assessment  of  the  risk.  As  an 
example,  13  questions  are  under  the  subsection  "Directing  Controls."  "Yes" 
responses  are  given  a  value  of  one,  and  "no"  responses  are  given  a  value  of 
zero.  Thus,  6  of  the  13  questions,  or  46  percent,  can  be  answered  negatively, 
indicating  weak  controls,  yet  the  overall  risk  assessment  for  that  subsection 
would  indicate  satisfactory  controls.  DCMC  needs  to  devise  a  more  appropriate 
system  that  will  give  a  more  realistic  assessment  of  the  risk. 

Manual  Risk  Assessment.  The  purpose  of  the  manual  risk  assessment  is  the 
same  as  that  of  the  automated  risk  assessment:  to  provide  management  a 
measure  of  vulnerability  to  fraud,  waste,  or  mismanagement.  Under  the  manual 
risk  assessment,  response  to  questions  and  determination  of  vulnerability  are 
manually  completed  by  the  preparer. 

Effectiveness  of  Manual  Risk  Assessments.  DCMC  did  not 
standardize  the  format  of  the  questionnaires  used  in  performing  manual  risk 
assessments.  As  a  result,  three  different  types  of  manual  risk  assessment 
questionnaires  were  used  at  the  field  offices  visited.  The  use  of  different 
formats  may  have  varying  impacts  on  the  results  of  the  overall  assessment. 
DCMC  should  standardize  the  questionnaire  so  that  all  district  and  field  offices 
determine  risk  consistently. 

The  manual  risk  assessments  disclosed  deficiencies  that,  in  our  opinion,  caused 
the  results  of  the  assessments  to  be  inadequate.  As  with  the  automat^  risk 
assessment,  the  manual  risk  assessment  disclosed  the  lack  of  weighting  of 
questions  and  questions  that  could  cause  the  preparer  to  either  provide  biased 
responses  or  feel  pressured  to  provide  responses  that  would  be  favored  by 
management. 

Answer  Keys.  The  answer  keys  used  for  the  manual  risk  assessments 
were  inconsistent  and  incorrect  for  selected  questions.  DCMD  Mid-Atlantic 
used  an  answer  key  of  1-Always,  2-Normally,  3-Sometimes,  4-RMely,  and 
5-Never.  DCMD  West  used  High  risk.  Moderate  risk,  or  Ix)w  risk,  while 
DCMD  Northeast  used  a  "Yes"  or  "No"  response.  The  answer  keys  used  by 
DCMDs  Mid-Atlantic  and  West  did  not  provide  appropriate  responses  to  some 
of  the  questions  being  asked.  For  example,  the  DCMD  Mid-Atlantic  answer 
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key  was  inappropriate  for  responding  to  the  question:  "The  program  has  been  in 
existence  more  than  2  years  and  is  expected  to  continue  for  at  least  2  years  with 
no  major  changes."  Personnel  were  unsure  how  to  answer  such  questions  and 
often  used  the  middle  response  of  "sometimes." 

Interpretation  of  Questions.  Negatively  phrased  questions  confused 
employees,  thereby  causing  them  to  answer  questions  in  the  opposite  manner 
than  intended.  For  example,  DCMD  Mid- Atlantic  risk  assessments  required  a 
response  to,  "Mission  does  not  involve  handling  cash  or  other  assets,  which  can 
be  easily  converted  for  personal  gain."  Other  questions  were  vague  and  left 
open  for  interpretation.  In  several  instances,  employees  knew  they  did  not 
handle  cash,  but  were  confused  by  the  negative  phrasing  of  the  question. 
Therefore,  they  ^swered  "never"  or  "rarely"  when  they  meant  to  answer 
"always."  The  misinterpretations  were  not  caught  during  supervisory  reviews. 
No  criteria  exist  on  how  to  interpret  the  questions,  and  thus  preparers  were  left 
confused  on  how  to  respond.  The  question  asking  whether  special  interest  has 
been  focused  on  the  program,  in  the  form  of  congressional  or  higher  levels  of 
inquiry,  media  attention,  litigation,  or  other  concerns,  is  another  example  of  a 
question  in  which  personnel  working  in  the  same  division  could  inteipret  the 
question  differently.  Some  employees  might  answer  the  question  "no," 
interpreting  it  to  involve  the  contract  administrative  functions  of  their  office, 
while  others  might  answer  the  same  question  "yes,"  interpreting  the  question  to 
involve  the  programs  for  which  their  office  has  contract  administrative 
responsibility. 

Criteria  on  Conducting  Risk  Assessments.  In  DCMD  West,  preparers 
lacked  any  instruction  or  guidance  on  how  to  assess  overall  risk  when  using  the 
manual  risk  assessment  method.  The  risk  assessment  was  divided  into 
three  sections:  Analysis  of  the  Inherent  Risk,  Evaluation  of  Safeguards,  and 
Analysis  of  the  General  Control  Environment.  Each  section  consist^  of 
eight  or  nine  questions,  with  the  choice  of  responses  being  high  risk,  moderate 
risk,  or  low  risk.  An  overall  risk  rating  of  high,  moderate,  or  low  was  then 
determined  for  the  section,  and  then  ultimately  for  the  entire  risk  assessment. 
However,  no  instruction  exists  on  how  to  determine  the  overall  risk  for  each 
section  and  for  the  entire  assessment.  Preparers  that  were  interviewed  stated 
they  were  able  to  arrive  at  low-risk  ratings  because  almost  all  their  responses  to 
the  questions  were  low  risk.  However,  if  the  responses  reflected  a  greater 
mixture  of  high,  moderate,  or  low,  the  preparers  did  not  know  how  to 
determine  the  overall  vulnerability.  DCMD  Northeast  also  had  no  instruction  or 
guidance  on  how  to  determine  overall  vulnerability  based  on  manual  risk 
assessments. 

Management  Involvement.  The  weaknesses  noted  concerning  the  risk 
assessment  tools  indicate  a  lack  of  management  involvement  with  the 
IMC  program.  The  problems  are  so  evident  that  management  should  have  been 
aware  of  and  should  have  corrected  these  problems.  In  our  opinion,  the 
deficiencies  continued  to  exist  because  DCMC  management  perceived  the  IMC 
program  to  be  immaterial.  Both  DCMC  Headquarters  and  the  districts 
interpreted  the  program  as  one  that  measures  the  risk  in  terms  of  the  costs  of  the 
office  and  not  the  potential  loss  of  the  mission  being  managed.  For  example, 
the  risk  associated  with  office  expenses  of  $300,000  would  be  far  less 
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significant  than  the  risk  associated  with  $300  million  of  contracts  administered 
by  the  office.  In  another  example,  we  determined  that  the  value  assigned  to 
computer  systems  was,  in  most  cases,  the  value  of  the  computer  hardware  and 
did  not  include  the  intrinsic  value  of  the  information  stored  in  the  computer. 
The  hardware  costs  are,  in  many  cases,  insignificant  when  compared  with  the 
potential  loss  of  irreplaceable  data  maintained  on  such  equipment. 


Performance  Standards  and  Plans 


Supervisory  personnel  were  generally  assigned  responsibility  and  made 
accountable  for  internal  control  duties.  Nonsupervisory  personnel  preparing 
risk  assessments  and  reviews  were  not  assigned  responsibility  for  internal 
control  duties  in  their  performance  plans  and  ratings.  Plans  should  include 
specific  responsibility  and  accountability  for  persons  in  charge  of  assessable 
units  and  for  persons  assigned  to  perform  risk  assessments  and  reviews.  In 
addition,  while  performance  plans  hold  employees  accountable,  the  plans  should 
not  use  measurement  techniques  that  could  bias  internal  control  results.  At 
three  of  the  DPROs  in  DCMD  Mid-Atlantic,  the  performance  plans  have  tied 
performance  on  internal  controls  to  (1)  "...no  significant  findings  in  internal 
controls,"  (2)  "...  successfully  passing  all  internal  or  external  reviews  with  no 
major  fault  found  due  to  procedural  noncompliance  related  to  internal  control," 
and  (3) "...  seldom  are  valid  deficiencies  uncovered  during  internal  reviews." 
These  types  of  criteria  are  more  likely  to  lead  employees  to  cover  up 
deficiencies  found  during  reviews  if  disclosing  deficiencies  would  negatively 
impact  the  employees'  ratings. 

Civilian  Personnel.  Personnel  who  performed  risk  assessments  and  IMC 
reviews  did  not  have  IMC  responsibilities  in  their  performance  plans.  These 
employees  were  usually  not  held  accountable  for  these  duties  since  performance 
plans  did  not  include  IMC  responsibilities.  For  example,  employees 
grade  GS-12  and  below  conducted  IMC  reviews  but  did  not  have  IMC 
responsibilities  written  into  their  performance  plans.  Of  the  73  performance 
plans  we  reviewed  (GS-07  through  GM-14  employees)  for  the  3  districts, 
5  included  a  separate  critical  element  for  IMC,  21  did  not  mention  IMC  as  a 
critical  element,  and  47  grouped  IMC  as  one  component  of  a  critical  element. 

All  personnel  performing  risk  assessments  and  conducting  IMC  reviews  should 
have  performance  plans  that  include  IMC  responsibilities,  and  they  should  be 
held  accountable  for  the  performance  of  those  duties.  The  inclusion  of  IMC 
responsibilities  in  a  critical  element  with  a  number  of  other  duties  may  allow  the 
significance  of  IMC  to  be  weakened  or  create  the  possibility  that  the  critical 
element  could  be  met  even  in  cases  where  IMC  duties  were  deficient. 

Military  Personnel.  Supervisory  military  personnel  assigned  responsibility  for 
assessable  units  (such  as  branch  and  division  chiefs)  did  not  have  specific 
written  standards  for  IMC  responsibilities.  Responsibility  was  merely  indicated 
by  a  box  that  was  checked  if  the  individual  had  IMC  responsibilities.  IMC 
accomplishments  generally  were  not  listed  on  annual  military  appraisals. 
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Military  appraisals  usually  highlight  military  accomplishments  that  promote 
advancement.  We  believe  IMC  responsibilities  should  be  written  into  military 
appraisals  and  performance  plans  to  help  promote  responsibility  and 
accountability  for  the  assigned  assessable  units. 

Monitors.  Each  district  and  field  office  designated  one  individual  as  the 
primary  IMC  monitor.  Field  offices  have  also  assigned  individuals  within  the 
divisions  as  monitors.  The  monitor  supports  the  program  by  disseminating  and 
collecting  reports  and  information.  The  monitor  must  also  be  prepared  to  assist 
local  officials  by  explaining  the  IMC  policies  and  procedures,  documentation 
requirements,  and  other  relevant  IMC  requirements.  The  local  monitor  should 
also  be  able  to  provide  basic  training  on  the  IMC  program.  The  monitor 
position  goes  well  beyond  clerical  duties;  however,  district  and  field  offices 
generally  did  not  include  the  IMC  responsibilities  in  the  performance  plans  of 
the  designated  individuals. 

At  the  district  offices,  the  individuals  assigned  as  IMC  monitors  did  not  check 
to  see  whether  the  reviews  contained  adequate  supporting  documentation  and 
whether  the  review  actually  tested  the  control  techniques  as  stated  in  the  IMC 
reviews.  The  monitors  primarily  reviewed  statements  of  assurance  from  the 
divisions,  which  were  used  to  draft  the  overall  annual  statement  of  assurance  for 
DCMC.  For  example,  the  person  at  DCMD  West  was  assigned  the  IMC 
monitor  position  on  a  part-time  basis  in  addition  to  regular  duties  and  had  no 
specific  duties  for  IMC  included  in  his  performance  plan.  The  DCMD  West 
IMC  monitor  position  has  been  vacant  since  1991.  Collecting  and  disseminating 
information  was  basically  the  only  IMC  duty  the  monitor  performed  b^ause 
other  responsibilities  required  most  of  the  work  day.  Also,  the  monitor  at 
DCMD  Mid-Atlantic  did  a  cursory  review  of  the  IMC  reviews  submitted 
because  of  the  large  number  of  documents  received,  leaving  the  monitor 
unaware  that  some  field  offices  were  not  reviewing  certain  event  cycles.  More 
emphasis  needs  to  be  given  to  the  IMC  monitor  positions.  The  function  of  that 
position  should  be  to  coordinate  the  IMC  program  in  that  district  and  verify 
that  the  program  is  properly  and  consistently  implemented.  Performance  plans 
should  specify  internal  control  responsibilities,  and  supervisors  should  hold  IMC 
monitors  accountable  for  performance  of  their  duties. 

Management  Emphasis.  Not  including  IMC  responsibilities  as  a  separate 
critical  element  in  civilian  performance  plans  and  military  appraisals  is  a  result 
of  the  lack  of  emphasis  DCMC  placed  on  the  IMC  prograni.  DCMC  did  not 
verify  toat  civilian  performance  plans  and  military  appraisals  included  a  separate 
critical  element  for  IMC  responsibilities.  In  our  opinion,  the  lack  of 
significance  in  the  treatment  of  the  IMC  duties  in  both  civilian  performance 
plans  and  military  appraisals  shows  the  low  level  of  importance  DCMC  gave  the 
IMC  program. 


20 


Finding  B.  Implementing  Tools  for  Internal  Management  Control 


Ongoing  DCMC  Corrective  Actions 


In  response  to  discussions  about  our  findings,  DCMC  and  DLA  management 
reevaluated  their  procedures  and  processes  and  took  action  to  correct  the 
conditions  identified.  The  DCMC  ongoing  corrective  actions  should  ultimately 
correct  all  the  deficiencies  disclosed  during  the  audit.  Therefore,  we  have 
determined  that  recommendations  for  corrective  actions  are  not  needed.  DCMC 
has  developed  the  following  actions  to  correct  the  deficiencies  noted  during  our 
audit. 

DCMC  Manual.  The  One  Book,  scheduled  for  release  by  September  30,  1993, 
will  standardize  the  format  for  conducting  IMC  reviews  and  risk  assessments  for 
all  of  DCMC. 

Risk  Assessments.  District  personnel  rather  than  field  office  personnel  will 
perform  risk  assessments  for  each  assessable  unit.  The  risk  assessment  will 
encompass  all  field  offices  in  the  district,  ensuring  that  the  most  significant 
areas  will  be  evaluated  and  that  the  selection  of  units  to  be  assessed  will  be 
consistent. 

DCMC  had  also  initiated  revisions  to  its  Automated  Risk  Assessment  Program. 
However,  our  review  of  those  revisions  revealed  that  deficiencies  still  existed. 
We  furnished  DCMC  with  our  recommended  changes  to  consider  in  further 
revisions  of  the  Automated  Risk  Assessment  Program.  The  suggestions 
included  weighting  questions  so  that  the  more  significant  questions  are  given 
greater  emphasis  in  determining  the  overall  vulnerability.  We  also  suggested 
that  the  risk  assessment  format  be  changed  to  allow  for  matching  controls  to  the 
related  risk.  The  overall  control  environment  may  be  considered  adequate  in 
relation  to  the  overall  potential  risk  of  loss,  but  a  critical  weakness  in  a  control 
related  to  a  significant  area  may  actually  represent  a  high  overall  risk  of 
potential  loss,  which  should  be  described  in  the  risk  assessment.  In  addition, 
we  suggested  that  certain  questions  be  highlighted  whereby  a  negative  response, 
regardless  of  the  overall  rating,  will  necessitate  an  additional  review  to  evaluate 
and  correct  the  situation.  For  example,  questions  that  may  generate  negative 
responses  are  "Does  management  support  the  internal  controls  in  place  on  this 
process?"  or  "Are  responsibilities  divided  so  that  no  single  official  or  worker 
controls  all  phases  of  a  critical  transaction?"  A  negative  response  to  these 
questions  is  indicative  of  a  deficiency  in  the  control  environment  and  would 
therefore  need  to  be  reviewed. 

Performance  Standards  and  Plans.  DLA  Policy  Division  requested  DLA's 
offices  of  Civilian  Personnel  and  Military  Personnel  to  review  issued  guidance 
to  ensure  that  the  guidance  adequately  describes  the  IMC  requirement  to  include 
IMC  responsibilities  and  duties  in  performance  plans.  In  addition,  both  offices 
were  requested  to  issue  a  policy  letter  to  principal  DCMC  Headquarters  staff 
elements  and  primary  field  activities  requiring  that  managers/ supervisors  and 
military  members  have  IMC  responsibilities  included  in  their  position 
descriptions  and  performance  plans. 
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Level 

Risk 

Risk 

At  Which 

Assessments 

Assessments 

Risk 

District/Field  Office 

Were 

Were 

Assessments 

Assessable  Units 

Prepared^ 

Complete^ 

Were  Performed^ 

DCMD  Mid-Atlantic 

District  Office  — 

Philadelphia,  PA 

Command  Support 

No 

Contract  Management 

Yes 

No^ 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS"^ 

Yes 

No^ 

Division 

DCMAO  Baltimore,  MD 

Command  Support 

Yes 

No^ 

Branch 

Contract  Management 

Yes 

No^ 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

No 

DCMAO  Springfield,  NJ 

Command  Support 

No 

Contract  Management 

No 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

Yes 

Yes 

Branch 

DCMAO  Reading,  PA 

Command  Support 

No 

Contract  Management 

Yes 

Nol 

Branch 

Quality  Assurance 

Yes 

No^ 

Branch 

P&TS 

Yes 

No^ 

Branch 

DPRO  Westinghouse 

Command  Support 

Yes 

Yes 

Division 

Contract  Management 

Yes 

No^ 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

Yes 

Yes 

Branch 

See  footnotes  at  end  of  appendix. 
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Level 

Risk 

Risk 

At  Which 

Assessments 

Assessments 

Risk 

District/Field  Office 

Were 

Were 

Assessments 

Assessable  Units 

Prepared^ 

Complete^ 

Were  Performed^ 

DCMD  Mid-Atlantic  fcont* dl 

DPRO  GEC/Kearfott 

Command  Support 

No 

Contract  Management 

Yes 

No^ 

Event  Cycle 

Quality  Assurance 

Yes 

No^ 

Branch 

P&TS 

Yes 

No^ 

Event  Cycle 

DPRO  General  Electric 

Aerospace 

Command  Support 

Yes 

No! 

Branch 

Contract  Management 

Yes 

Nol 

Division 

Quality  Assurance 

Yes 

Not 

Branch 

P&TS 

Yes 

No^ 

Branch 

DPRO  General  Dynamics 

Command  Support 

Yes 

Yes 

Division 

Contract  Management 

Yes 

Yes 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

Yes 

Yes 

Branch 

DPRO  Loral 

Command  Support 

No 

Contract  Management 

Yes 

Yes 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

Yes 

Yes 

Branch 

DCMD  West 

District  Office  — 

El  Segundo,  CA 

Command  Support 

Yes 

Yes 

Branch 

Contract  Management 

Yes 

Yes 

Branch 

Quality  Assurance 

Yes 

Yes 

Branch 

P&TS 

Yes 

Yes 

Branch 

Planning  and  Resource 

Management 

Yes 

Yes 

Division 

See  footnotes  at  end  of  appendix. 
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Risk  Risk 

Assessments  Assessments 

District/Field  Office  Were  Were 

Assessable  Units  Prepared^  Complete^ 


DCMD  West  (cont'd) 


Administration  and 

Information  Management 
Civilian  Personnel 

DCMAO  Phoenix,  AZ 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DCMAO  Santa  Ana,  CA 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

General  Counsel/Small 
Business 

DCMAO  Van  Nuys,  CA 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DPRO  Hughes 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DPRO  McDonnell  Douglas,  AZ 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 


Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

No’ 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

See  footnotes  at  end  of  appendix. 


Level 
At  Which 
Risk 

Assessments 
Were  Performed^ 


Branch 

Division 


Branch 

Branch 

Branch 

Division 


Branch 

Branch 

Branch 

Branch 

Division 


Branch 

Branch 

Division 

Division 


Division 

Branch 

Branch 

Branch 


Branch 

Branch 

Branch 

Branch 


26 


Appendix  A.  Summary  of  Risk  Assessments 


District/Field  Office 
Assessable  Units 

DCMD  West  (conf  d) 


Risk 

Assessments 

Were 

Prepared^ 


Level 

Risk  At  Which 

Assessments  Risk 

Were  Assessments 

Complete^  Were  Performed^ 


DPRO  McDonnell  Douglas,  CA 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DPRO  General  Dynamics 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DPRO  TRW  Space 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 


Yes 

Yes 

Division 

Yes 

Yes 

Branch 

Yes 

Yes 

Division 

Yes 

Yes 

Branch 

Yes 

Yes 

Division 

Yes 

No^ 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

DCMD  Northeast 


District  Office  --  Boston,  MA 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DCMAO  Boston,  MA 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DCMAO  Garden  City,  NY 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 


Yes 

Yes 

Division 

Yes 

Yes 

Division 

No 

Yes 

Yes 

Division 

Yes 

Yes 

Branch 

Yes 

No^ 

Branch 

Yes 

Yes 

Branch 

No 

No 

Yes 

Yes 

Branch 

Yes 

Yes 

Division 

Yes 

Yes 

Branch 

See  footnotes  at  end  of  appendix. 
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District/Field  Office 
Assessable  Units 

[IMP  Northeast  (cont'd) 

DPRO  Raytheon 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 

DPRO  Grumman 
Command  Support 
Contract  Management 
Quality  Assurance 
P&TS 


Risk 

Assessments 

Were 

Prepared^ 


Risk 

Assessments 
Were  . 


Level 
At  Which 
Risk 

Assessments 
Were  Performed^ 


Yes 

Yes 

Division 

No 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

Yes 

Yes 

Branch 

^  Fourteen  offices  did  not  perform  risk  assessments  or  did  not  perform  complete  risk 
assessments  or  both.  Of  the  14  offices,  5  offices  did  not  perform  risk  assessments  on 
all  assessable  units,  4  offices  performed  incomplete  risk  assessments  on  assessable 
units,  and  5  offices  had  both  conditions.  In  total,  10  offices  (5  with  no  risk 
assessments  and  5  with  both  traits)  did  not  perform  risk  assessments  on  all  assessable 
units,  and  9  offices  performed  incomplete  risk  assessments.  In  the  9  offices,  56  manual 
risk  assessments  were  improperly  completed.  Details  are  contained  in  footnotes  3,  5, 
6,  and  7  of  this  appendix.  We  reviewed  a  total  of  154  manual  risk  assessments  at  the 
23  offices  visited. 

^  DLAR  5010.4  specifies  that  risk  assessments  should  be  performed  on  ^1  assessable 
units.  Assessable  units  were  identified  as  branches  within  the  offices.  Fifteen  offices 
performed  risk  assessments  at  the  division  level  or  on  event  cycles  instead  of  on 
branches  as  specified. 

^  The  preparer  or  the  reviewer  or  both  did  not  sign  or  date  38  risk  assessments:  1  at 
DCMD  Mid-Atlantic,  36  at  DPRO  GEC/  Kearfott,  and  1  at  DCMAO  Boston. 

Program  and  Technical  Support  Division. 

^  No  questionnaire  accompanied  the  overall  risk  rating.  A  total  of  20  risk  assessments 
were  prepared  in  this  manner:  1  at  DCMD  Mid-Atlantic,  5  at  DCMAO  Baltimore,  6  at 
DCMAO  Reading,  and  8  at  DPRO  General  Electric  Aerospace. 

^  Not  all  questions  in  the  risk  assessment  questionnaire  were  answered.  One  risk 
assessment  at  DPRO  Westinghouse  was  prepared  in  this  manner. 

”  The  preparer  did  not  identify  an  overall  risk  level  for  the  assessable  unit.  A  total  of 
five  risk  assessments  were  prepared  in  this  manner:  two  at  DCMAO  Santa  Ana  and 
three  at  DPRO  General  Dynamics. 
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Appendix  B.  Summary  of  Internal  Management  Control  Reviews 
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DCMAO  Van  Nuys,  CA 
DCMAO  Phoenix,  AZ 
DPRO  McDonnell  Douglas,  AZ 


Appendix  B.  Summary  of  Internal  Management  Control  Reviews 
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Appendix  C.  Activities  Visited  or  Contacted 


Defense  Activities 

Defense  Logistics  Agency,  Alexandria,  VA 

Defense  Contract  Management  Command,  Alexandria,  VA 
Defense  Contract  Management  Districts 
Mid-Atlantic,  Philadelphia,  PA 
Northeast,  Boston,  MA 
West,  El  Segundo,  CA 

Defense  Contract  Management  Area  Offices 
Boston,  MA 
Garden  City,  NY 
Phoenix,  AZ 
Reading,  PA 
Santa  Ana,  CA 
Springfield,  NJ 
Baltimore,  MD 
Van  Nuys,  CA 

Defense  Plant  Representative  Offices 
GEC/Kearfott,  Wayne,  NJ 
General  Electric  Aerospace,  Cherry  Hill,  NJ 
General  Dynamics,  Pomona,  CA 
General  Dynamics,  Lima,  OH 
Grumman,  Bethpage,  NY 
Hughes,  Tucson,  AZ 
Loral,  Akron,  OH 
McDonnell  Douglas,  Mesa,  AZ 
McDonnell  Douglas,  Huntington  Beach,  CA 
Raytheon,  Burlington,  MA 
TRW  Space,  Redondo  Beach,  CA 
Westinghouse,  Baltimore,  MD 
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Appendix  D.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Director  of  Defense  Procurement 
Comptroller  of  the  Department  of  Defense 
Assistant  Secretary  of  Defense  (Public  Affairs) 


Defense  Activities 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Logistics  Agency 

Commander,  Defense  Contract  Management  Command 


Non-Defense  Agencies 

Office  of  Management  and  Budget 

National  Security  and  International  Affairs  Division,  Technical  Information  Center, 
General  Accounting  Office 

Chairman  and  Ranking  Minority  Member  of  Each  of  the  Following  Congressional 
Committees  and  Subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Operations 

House  Subcommittee  on  Legislation  and  National  Security,  Committee  on 
Government  Operations 
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Audit  Team  Members 


David  K.  Steensma  Director,  Contract  Management  Directorate 

Salvatore  D.  Guli  Audit  Program  Director 

Bruce  A.  Burton  Audit  Project  Manager 

Steven  1.  Case  Senior  Auditor 

LaNita  C.  Matthews  Auditor 

Stephanie  M.  Haydon  Auditor 

Kelly  D.  Garland  Auditor 

John  A.  Seger  Auditor 

Dave  Barton  Operations  Research  Analyst 

Ana  M.  Myrie  Administrative  Support 


INTERNET  DOCUMENT  INFORMATION  FORM 


A .  Report  Title:  The  Internal  Management  Control  Program  at  the  Defense 
Contract  Management  Command 


B.  DATE  Report  Downloaded  From  the  Internet:  04/18/99 


C.  Report’s  Point  of  Contact:  (Name,  Organization,  Address,  Office 
Symbol,  &  Ph  #):  OAIG-AUD  (ATTN:  AFTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Arlington,  VA  22202-2884 


D.  Currently  Applicable  Classification  Level:  Unclassified 

E.  Distribution  Statement  A:  Approved  for  Public  Release 

F.  The  foregoing  information  was  compiled  and  provided  by: 

DTIC-OCA,  Initials: _ VM _ Preparation  Date  04/18/99 


The  foregoing  information  should  exactly  correspond  to  the  Title,  Report  Number,  and  the  Date  on 
the  accompanying  report  document.  If  there  are  mismatches,  or  other  questions,  contact  the 
above  OCA  Representative  for  resolution. 


